Live › vulnerability › CVE-2026-98667
Go to dashboardThe Linux kernel's ADF4377 IIO frequency driver left parts of its clock init structures uninitialized, which can cause a crash when the kernel is built with stack-initialization debug options. The sources describe a stability bug with no stated remote exploit path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the adf4377 driver loaded, typically embedded or RF hardware using the ADF4377 frequency synthesizer. The bug only surfaces when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is enabled, so default-config kernels are less likely to hit it. unknown for whether a standard distribution kernel is affected.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
iio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_data
The clk_init_data structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initialize only the members they need. However, not initializing all members may cause subtle issues, which are only exposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is enabled.
adf4377_clk_register() fills in init.parent_data, and assumes that init.parent_names is NULL. However, the latter is uninitialized, and thus may cause a crash.
Similarly, adf4377_clk_register() fills in only parent_data.fw_name, leaving other members of the clk_parent_data structure uninitialized.
Make sure all members are fully initialized, to fix such bugs, and to avoid future breakage when converting drivers to a different method for specifying the parents.
This page as .md · .json · in your agent: get_signal("CVE-2026-98667")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.